diff --git a/kube/deploy/core/system-upgrade-controller/app/hr.yaml b/kube/deploy/core/system-upgrade-controller/app/hr.yaml
index ce83d592..0e8e0ef5 100644
--- a/kube/deploy/core/system-upgrade-controller/app/hr.yaml
+++ b/kube/deploy/core/system-upgrade-controller/app/hr.yaml
@@ -32,7 +32,7 @@ spec:
               SYSTEM_UPGRADE_JOB_ACTIVE_DEADLINE_SECONDS: 900
               SYSTEM_UPGRADE_JOB_BACKOFF_LIMIT: 99
               SYSTEM_UPGRADE_JOB_IMAGE_PULL_POLICY: IfNotPresent
-              SYSTEM_UPGRADE_JOB_KUBECTL_IMAGE: registry.k8s.io/kubectl:v1.29.1@sha256:59b3035b8826b0a1d5d950588ecc3f33cbc3bb9b5a70735245691a211821a22f
+              SYSTEM_UPGRADE_JOB_KUBECTL_IMAGE: registry.k8s.io/kubectl:v1.29.2@sha256:ac66c804f411269a1caa8cc907447fcd00a4476cfb627a4756845c85e685a671
               SYSTEM_UPGRADE_JOB_PRIVILEGED: true
               SYSTEM_UPGRADE_JOB_TTL_SECONDS_AFTER_FINISH: 900
               SYSTEM_UPGRADE_PLAN_POLLING_INTERVAL: 15m
diff --git a/kube/deploy/core/system-upgrade-controller/plans/talos/app/talos.yaml b/kube/deploy/core/system-upgrade-controller/plans/talos/app/talos.yaml
index 5a96276b..382e234d 100644
--- a/kube/deploy/core/system-upgrade-controller/plans/talos/app/talos.yaml
+++ b/kube/deploy/core/system-upgrade-controller/plans/talos/app/talos.yaml
@@ -21,7 +21,7 @@ spec:
     matchLabels:
       kubernetes.io/os: "linux"
   prepare: &prepare
-    image: "registry.k8s.io/kubectl:v1.29.1@sha256:59b3035b8826b0a1d5d950588ecc3f33cbc3bb9b5a70735245691a211821a22f"
+    image: "registry.k8s.io/kubectl:v1.29.2@sha256:ac66c804f411269a1caa8cc907447fcd00a4476cfb627a4756845c85e685a671"
     args: # if Ceph is completely healthy, surely k8s is healthy, right?
       - "wait"
       - "--timeout=300s"